[PATCH] staging: rtl8723bs: fix potential speculative cpu oob read

[Linus Probert]

Fixes potential speculative cpu oob read in os_intfs.c by guarding the
index with array_index_nospec.

Fixes smatch warning:
warn: potential spectre issue 'rtw_1d_to_queue' [r]

Signed-off-by: Linus Probert <linus.probert@xxxxxxxxx>
---

I can't argue with 100% certainty if this is a real risk. I found the
warning when I was testing out smatch (awesome work on that by the way)
and thought I'd take a look.

I did a quick search on the linux-staging list but couldn't find any
mention of 'spectre'. So as far as I could see it hasn't been brought up
before.

Was unsure if I should prefix this with RFC first.

 drivers/staging/rtl8723bs/os_dep/os_intfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/os_intfs.c b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
index e943dcea1a21..8eea05111e79 100644
--- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
@@ -347,7 +347,7 @@ static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb,
 	if (pmlmepriv->acm_mask != 0)
 		skb->priority = qos_acm(pmlmepriv->acm_mask, skb->priority);
 
-	return rtw_1d_to_queue[skb->priority];
+	return rtw_1d_to_queue[array_index_nospec(skb->priority, ARRAY_SIZE(rtw_1d_to_queue))];
 }
 
 u16 rtw_recv_select_queue(struct sk_buff *skb)
@@ -374,7 +374,7 @@ u16 rtw_recv_select_queue(struct sk_buff *skb)
 		priority = 0;
 	}
 
-	return rtw_1d_to_queue[priority];
+	return rtw_1d_to_queue[array_index_nospec(priority, ARRAY_SIZE(rtw_1d_to_queue))];
 }
 
 static int rtw_ndev_init(struct net_device *dev)
-- 
2.54.0